CVE-2021-31728 PoC — MalwareFox Anti-Malware 安全漏洞

Source

https://github.com/irql/CVE-2021-31728

Associated Vulnerability

Title: MalwareFox Anti-Malware 安全漏洞 (CVE-2021-31728)
Description:Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.

Description

vulnerability in zam64.sys, zam32.sys allowing ring 0 code execution. CVE-2021-31727 and CVE-2021-31728 public reference.

Readme

### CVE-2021-31727 and CVE-2021-31728
###### [Public Reference for CVE-2021-31727](CVE-2021-31727.md)
Exposes unrestricted disk read/write capabilities.
###### [Public Reference for CVE-2021-31728](CVE-2021-31728.md)
Exposes arbitrary ring 0 code execution directly.

![](poc.gif)
### Credit
[Lima X](https://github.com/Lima-X) helped with SystemBigPoolInformation idea.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →